Data Processing Addendum

1. Scope and definitions

This DPA is part of the School Agreement and applies to Personal Data Ekadem processes for Customer. “Data Protection Law” includes the GDPR, applicable EEA/UK implementations where selected, Swiss FADP and implementing ordinance, and applicable national, cantonal, state and education-sector privacy law. Statutory terms keep their legal meaning.

Customer is controller, public body or responsible educational agency and Ekadem is processor/service provider for School Data, unless Annex 1 identifies a different lawful role. Customer is responsible for its lawful basis, transparency, data accuracy, source and documented instructions.

2. Instructions and purpose limits

Ekadem processes Personal Data only on documented instructions in the Agreement, Order Form, school configuration and authorized support requests, including instructions needed for the agreed deployment and approved integrations. If law requires other processing, Ekadem informs Customer before it occurs unless prohibited. Ekadem will promptly flag an instruction it reasonably believes violates Data Protection Law and may pause only the affected processing while the parties resolve it.

Ekadem will not sell School Data, share it for targeted advertising, create unrelated profiles, reidentify de-identified data, train general-purpose models, or combine it with data obtained for another customer except as necessary to provide or secure the multi-tenant service with tenant separation.

3. Personnel and confidentiality

Access is limited to authorized personnel with a need, appropriate training and binding confidentiality. Privileged access uses least privilege, MFA where supported, logging and review. Confidentiality continues after access ends.

4. Security measures

Ekadem implements and maintains measures appropriate to the nature, volume, context and child/education risk, including the Annex 2 controls. It regularly assesses effectiveness and will not materially reduce overall protection during the term. Customer remains responsible for secure administrators, endpoints, instructions, content and configurations within its control.

5. Subprocessors

Customer gives general written authorization for subprocessors in the current Schedule. Ekadem gives at least 30 days’ advance notice before a new subprocessor processes School Data, except an emergency replacement needed to protect security or continuity, which is notified as soon as practicable. Customer may object within the notice period on documented data-protection grounds. The parties will seek a reasonable alternative; if none exists, Customer may terminate the materially affected feature without penalty.

Ekadem contracts each subprocessor for equivalent data-protection, confidentiality, security, incident, deletion and audit duties and remains responsible for its performance to the extent law requires. A candidate provider is not authorized until listed as active.

6. Rights requests

Taking account of the processing, Ekadem provides reasonable technical and organizational assistance with access, copy, correction, restriction, objection, portability, deletion and automated-decision rights. If a requester contacts Ekadem about School Data, Ekadem verifies minimally, routes the request to Customer and does not independently change the education record unless instructed or legally required. Customer controls the response; Ekadem meets the shorter applicable contract/statutory support deadline.

7. DPIAs, records and regulators

Ekadem provides information reasonably necessary for Customer’s record of processing, privacy/AI impact assessment, transfer assessment, prior consultation, public-records/security questionnaire and regulator response. This includes purposes, data, recipients, countries, retention, controls and material limitations. Customer remains responsible for deployment-specific decisions, learner notices and consultation with its DPO/authority.

8. Personal Data incidents

Ekadem notifies Customer without undue delay after confirming a breach of security affecting Customer Personal Data and targets initial notice within 24 hours. Notice includes known nature, timing, data/categories and approximate people/records; likely consequences; containment/remediation; and a contact. Information may be supplied in phases and notification is not an admission of fault.

Ekadem preserves evidence, investigates, mitigates, supports legally required notices and does not notify affected school users or authorities without coordination unless law assigns that duty to Ekadem. Customer makes controller notifications. A stricter mandatory timeline controls.

9. Government and third-party demands

Ekadem verifies demands, limits disclosure, redirects the requester to Customer where lawful, challenges unlawful or disproportionate demands, documents the response and gives advance notice unless prohibited. It will not voluntarily provide bulk or backdoor access.

10. Return and deletion

Customer can export available School Data during the term. At instruction or contract end, Ekadem returns or deletes active School Data within 30 days unless the Order Form is shorter. Deletion covers active database rows, objects, indexes and ordinary caches. Isolated backups are not restored for normal use and expire within 35 days. Legal holds and mandatory billing/security evidence are segregated, access-limited and deleted when the obligation ends. Ekadem certifies deletion on request.

11. Audit and evidence

Ekadem supplies current policies, summaries, test reports, questionnaires and independent assurance reasonably necessary to demonstrate compliance, subject to confidentiality and security. If that is insufficient after a substantiated concern, Customer may conduct one proportionate annual audit through an independent confidential auditor, without accessing another customer’s data or creating risk. Additional review is allowed after a material incident or regulator demand. The parties coordinate scope, timing and reasonable cost.

12. International transfers

The Order Form identifies the agreed deployment and disclosed countries. An EU label does not cover every identity/support system. For restricted transfers, the parties incorporate the current European Commission Standard Contractual Clauses: Module Two for controller-to-processor and Module Three where Customer is a processor, as applicable. The optional docking clause applies; the competent authority and law are completed in the Order Form. Swiss-covered transfers use the same clauses with FADP references, Swiss data subjects, FDPIC authority and Swiss law/forum adaptations where required.

Ekadem supplies information for a transfer impact assessment and implements supplementary technical/organizational measures. If a transfer mechanism becomes invalid, the parties promptly use a lawful replacement or suspend the affected transfer.

Annex 1 — Processing details

Annex 2 — Technical and organizational measures

• Governance: assigned owners, policies, data inventory, risk assessment, training, incident and continuity plans.
• Identity/access: managed authentication, role/tenant checks, least privilege, MFA for privileged access, prompt offboarding and access review.
• Cryptography: TLS in transit, provider encryption at rest, controlled key/secret access.
• Application: server-side authorization, input validation, safe error handling, dependency review, code/change review and environment separation.
• Operations: security logging, monitoring, rate limits, backup/restore procedures, vulnerability intake, remediation and controlled support access.
• Data lifecycle: agreed deployment boundaries, minimization, retention/deletion schedule, export and disposal verification.
• AI: provider allowlist, school approval gate, no-training/ZDR requirement, minimal context, model metadata and human-review controls.
• Vendors: due diligence, DPA/flow-down, country and subprocessor review, incident/deletion commitments and change notice.

Assurance gaps and launch blockers are disclosed in the Security Overview rather than represented as completed certifications.

Requested custom deployment

Where agreed in the Order Form, a separate school installation uses Hetzner in named EU locations for the LMS and agreed backups, Clerk for identity, TensorX for inference, and Cloudflare Email Service to deliver its email. TensorX is the only AI route on that installation; unavailable features do not fall back to another provider. Cloudflare receives only the email messages it delivers, which it may process outside the EU. Clerk’s and Cloudflare’s separate processing locations and any approved optional services remain governed by the school-specific schedule and transfer terms. This choice does not create a general EU-only promise for every external identity or support record.

Annex 3 — Customer-specific choices

The signed Order Form must complete: controller and DPO contacts; institution type; country/state/canton/German Land; age bands and authorization; school year/retention; default Cloudflare service or requested custom school deployment; agreed hosting and backup locations; identity processing and transfers; approved AI/integrations; special-category restrictions; authorized support regions; incident contacts; SCC law/authority; and any local public-sector schedule.